Time-of-Check to Time-of-Use, or TOCTOU, is a bug class where software verifies that something is safe, then uses it later after it may have changed. The gap can be very small: a file, path, permission, or symlink can look trustworthy during validation and become malicious before execution or access.
TOCTOU matters because security decisions must protect the exact object that will be used, not a stale copy of it. In real attacks, this pattern can let an attacker swap files, redirect paths, or alter settings between validation and use, turning a routine check into code execution, privilege abuse, or integrity bypass. Defenses include opening resources first and checking the same handle, avoiding separate check-and-use steps, using atomic operations, and revalidating critical state immediately before action.